Privacy Policy

1. Who we are

The Cellar Club is operated by CD WINES LTD, a company registered in England and Wales (company number 15796479). If you have any questions about this policy or your personal data, please contact us at hello@crushwines.co.

2. What data we collect

When you sign up for The Cellar Club we collect the following personal information:

• First name
• Mobile phone number
• Email address
• Date of birth (for age verification)
• Payment details — your card is tokenised and stored securely by Stripe. We never see or store your full card number.

We also collect records of your orders, cellar holdings, and shipments as part of providing the service.

3. Why we collect it

• To operate your Cellar Club account and fulfil your orders
• To process payments for bottles you have ordered
• To verify that you are 18 or over, as required by law
• To send you wine offer texts by SMS — you give explicit consent to this at sign-up and can withdraw it at any time
• To comply with our legal and regulatory obligations

4. Who we share it with

We do not sell your personal data to any third party. We share data only with the following processors, each of whom is GDPR compliant:

• Stripe — payment processing and secure card storage
• Twilio — SMS delivery of offer texts and order confirmations

Each processor acts only on our instructions and under data processing agreements that meet UK GDPR requirements.

5. How long we keep it

• Active customers: for the duration of your membership plus 7 years thereafter, to meet our financial record-keeping obligations.
• Unsubscribed customers: your account is anonymised within 2 years of unsubscribing, retaining only aggregate transactional data required for accounting.

6. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure of your data (subject to legal retention requirements)
• Restrict or object to how we process your data
• Withdraw your consent to marketing texts at any time (text STOP)

To exercise any of these rights, email hello@crushwines.co. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk.

7. Lawful basis for processing

We process your personal data on the following bases:

• Contractual necessity — to fulfil your orders and operate your account
• Legitimate interests — to maintain accurate business records and prevent fraud
• Explicit consent — to send you marketing texts; this consent is obtained at sign-up and can be withdrawn at any time by texting STOP or emailing us
• Legal obligation — to retain financial records and comply with licensing requirements

8. Governing law

This policy is governed by UK GDPR and the Data Protection Act 2018. CD WINES LTD is the data controller for the purposes of that legislation.